Patients & Visitors' Guide
HIPAA Protected Health Information
The Health Insurance Portability and Accountability Act (HIPAA)
is now in effect. The regulation provides consumers with
critical rights to control the release of their medical
information. The law also outlines how an individual's health
care information should be used.
For help in understanding HIPAA, Northeast Hospital Corporation
has published, "A Guide To Your Medical Information". The
guide is a brief overview of your rights and our responsibilities
to you, the patient and is published in its entirety below.
We also have a link to our
Release of Information form, which must be signed by you
as the patient or your legal representative prior to any release of
your medical information not otherwise required by law.
HIPAA Notice of Privacy
Your Information. Your Rights. Our
This notice describes how medical information about you
may be used and shared. It also explains how you can get access to
this information. Please review it carefully.
For more information on privacy protections at Lahey
Health, please visit Lahey.org/Hipaa or call the Lahey Health
Privacy Toll-free Hotline: 844.663.4677.
The facilities and offices that make up Lahey Health are
considered a single affiliated "covered entity." They will share
protected health information with each other, as necessary, to
carry out treatment, payment, or health care
This section explains your rights and some of our
responsibilities to help you. You have the right to:
Get an electronic or paper copy of your medical
- You can ask to see or get an electronic or paper copy of your
medical record and other health information we have about you. Ask
us how to do this.
- We will provide a copy or a summary of your health information,
usually within 30 days of your request. We may charge a fee based
on the cost of what you request.
- Lahey Health keeps medical records for at least 20 years after
your discharge (from a stay in the hospital) or after your final
outpatient visit or treatment, as required by state law. A copy of
the hospital's medical record retention policy is available upon
Ask us to amend your medical record
- You can ask us to correct health information about you that you
think is incorrect or incomplete. Ask us how to do this.
- We may say "no" to your request, but we'll tell you why in
writing within 60 days. You will have the right to include a
written statement in your record if you disagree with the
Request confidential communications
- You can ask us to call you in a specific way (for example, at
home, at the office, or on your cell phone) or to send mail to a
- We will say "yes" to all reasonable requests.
Ask us to limit what information we use or
- You can ask us not to use or share certain health information
for treatment, payment, or our operations. We are not required to
agree to your request, and we may say "no" if it would affect your
- If you pay for a service or health care item fully on your own
(without insurance coverage), you can ask us not to share that
information with your health insurer. We must say "yes" unless a
law requires us to share that information.
- We will not share certain information that has special
protections under the law, like notes taken during psychotherapy,
unless you specifically tell us we can in writing.
- We will not share any substance abuse treatment records without
your written permission.
Get a list of those with whom we've shared
- You can ask for a list (or an accounting) of the times we've
shared your health information for 6 years before the date you ask.
You can also ask whom we shared it with and why. We will include
all the disclosures except for those about treatment, payment,
health care operations, and certain other disclosures (such as any
you asked us to make). We will provide you with one accounting a
year for free but will charge a fee if you ask for another one
within 12 months.
Get a copy of this privacy notice
- We will provide you with a paper copy of this notice at any
time, even if you have agreed to receive the notice
Choose someone to act for you
- You can choose a health care agent (proxy) or give someone
medical power of attorney to exercise your rights and make choices
about your health information and treatment if you are not able to
make choices. Ask us how to do this.
Refuse to answer questions
- We may need your help in collecting your health
- If you choose not to answer, we will fill in the information as
best we can.
- You do not have to answer every question to receive
File a complaint if you feel your rights are violated or
request more information
- You can complain if you feel we have violated your rights or
request further information by contacting the Lahey Health
Privacy Toll-free Hotline:
- You can also file a complaint with the U.S. Department of
Health and Human Services Office for Civil Rights by sending a
letter to 200 Independence Avenue, S.W., Washington, D.C. 20201,
calling 877.696.6775, or visiting www.hhs.gov/ocr/privacy/hipaa/complaints.
- We will not retaliate against you for filing a complaint.
In certain instances, you can tell us how you want us to share
your information. If you have a clear preference for how we share
your information in the situations described below, talk to us.
Tell us what you want us to do, and we will follow your
instructions. You have both the right and choice to tell us if we
- Share information with your family, close friends, or others
involved in your care
- Share information about you in a disaster relief situation
- Include your name and location in a hospital "directory" list
that is available to anyone who calls the hospital
If you are not able to tell us your preference-for example,
if you are unconscious-we may go ahead and share your information
if we believe it is in your best interest.
We will never share or use your information for
marketing purposes and will never sell your information
unless you give us written permission ahead of time.
If we are raising funds for Lahey Health, we may contact you,
but we will also give you an easy way to tell us not to contact you
again for this purpose.
Our Uses and Disclosures
How do we typically use or share your health
- Treatment: We use your health information and
share it with other professionals who are treating you.
Example: We may share your information if a doctor treating you
for an illness or injury asks about your overall health
- Health care operations: We use and share your
health information to run Lahey Health, improve patient care, and
contact you when necessary. Example: We use health information
to evaluate the care and treatment results in your case and those
of others with similar conditions.
- Payment: We use and share your health
information to bill and obtain payment from health plans or other
entities. Example: We give information about the care you
received to your health insurance plan so it will pay for those
How else can we use or share your health
Lahey Health is allowed or required to share your information in
other ways-usually in ways that contribute to the public good. By
law, we have to meet many conditions before we can share your
information for these purposes. Here are some examples:
- Public health and safety efforts:
- Preventing disease
- Helping with product recalls
- Reporting adverse reactions to medications
- Reporting suspected abuse, neglect, or domestic violence
- Preventing or reducing a serious threat to anyone's health or
- Conducting clinical research: Lahey Health's
Privacy Board reviews all requests to use identifiable patient
information in clinical research.
- Complying with the law: Lahey Health will
share information about you if state or federal laws require it,
including with the U.S. Department of Health and Human Services if
it wants to see that we are complying with federal privacy
- Responding to organ and tissue donation
- Working with a medical examiner, coroner, or funeral
director when an individual dies
- Addressing workers' compensation, law enforcement, and
other government requests
- Responding to lawsuits and legal actions
Lahey Health must share health information about you in response
to a court or administrative order, or in response to a subpoena or
Special Confidentiality Protections for
Alcohol and Drug Abuse Treatment
If you have received treatment, diagnosis, or referral for
treatment from our substance use disorder programs, the
confidentiality of drug or alcohol use records is protected by
federal law and regulations. As a general rule, we may not tell a
person outside the programs that you attend any of these programs,
or disclose any information identifying you as an alcohol or drug
- you authorize the disclosure in writing; or
- the disclosure is permitted by a court order; or
- the disclosure is made to medical personnel in a medical
emergency or to qualified personnel for research, audit, or program
You should also know
- A violation by us of the federal law and regulations governing
drug or alcohol use is a crime. Suspected violations may be
reported to the United States Attorney at 617.748.3100.
- Information about a crime committed by a patient either at the
program or against any person who works for the program or about
any threat to commit such a crime is not protected.
- These laws do not protect any information about suspected child
abuse or neglect from being reported to appropriate
For more information see 42 U.S.C. § 290dd-2 and 42
C.F.R., Part 2.
- Lahey Health is required by law to maintain the privacy and
security of your health information.
- We must let you know promptly if a breach occurs that may have
compromised the privacy or security of your information.
- We must follow the duties and privacy practices described in
this notice and give you a copy of it.
- We will not use or share your information other than as
described here unless you tell us in writing we may do so. Even if
you give us permission, you may change your mind at any time. Let
us know in writing if you change your mind.
For more information, see:
Changes to the Terms of this Notice
We can change the terms of this notice, and the changes will
apply to all information we have about you. The new notice will be
available upon request, in our offices, and on our web sites
-Lahey.org, BeverlyHospital.org and WinchesterHospital.org.